Source: cloudflare/skills · Maintainer: Cloudflare · License: Apache-2.0 · Checked: 24 October 2026
What is the Cloudflare One skill?
The cloudflare-one skill is Cloudflare's official Agent Skill for Cloudflare One, its Zero Trust and SASE platform. It helps your coding agent design, configure, troubleshoot and review deployments across Access, Gateway, the device client (WARP), Tunnel, DLP, CASB, device posture and Cloudflare WAN, with guardrails that keep it from guessing.
Its SKILL.md description reads: "Design, configure, troubleshoot, or review Cloudflare One Zero Trust and SASE deployments. Use cloudflare-one-migrations for migration planning from other vendors."
The first instruction sets the tone: before citing "limits, settings, API fields, category IDs, or exact UI paths, retrieve current information from the Cloudflare One docs, the Cloudflare docs MCP server, or the Cloudflare API schema." Its skills.sh page listed 91.6K installs (snapshot, 24 October 2026).
What does it do?
The folder holds one long SKILL.md. It reads like a network engineer's runbook, organized in five parts.
1. A five-step workflow. Classify the ask (architecture, configuration, troubleshooting, migration or review), gather context (identity provider, SCIM, device management, traffic path, compliance, blast radius), retrieve only the docs needed, inspect existing resources if account access is available, then propose a change set "with prerequisites, validation, and rollback."
2. Assessment prompts. Questions to ask before configuring anything, grouped by area: architecture and current state, Access and SaaS federation, Tunnel and private networking, Gateway with TLS and DLP, CASB with device posture and risk, and Cloudflare WAN. Each points to the relevant page in the Cloudflare One docs.
3. Guardrails. The largest part. A sample:
- "Access controls application authorization; Gateway controls traffic inspection/filtering." Use both when a requirement spans the two.
- For new Access deployments, create reusable policies through
/access/policiesand attach them to apps, rather than sending inlinepoliciesin an app request. - "Access policies are default-deny. A private app with routes but no Allow policy still blocks access."
- Gateway group selectors use synced IdP groups, not Access Groups, and group names are case sensitive.
- Private hostnames need explicit DNS routing; "creating an Access app alone is not enough."
- "A healthy tunnel only proves cloudflared can reach Cloudflare." Routes still have to exist.
- DLP profiles "enforce nothing until referenced by a DLP policy or a CASB integration."
- Do not recommend the Gateway Audit SSH action, which reached end of life on 15 July 2026, as Cloudflare's deprecations page confirms; use Access for Infrastructure command logging instead.
4. Device client and split tunnels. The skill calls split tunnel mode "the single most impactful client setting" and gives a table for choosing it:
| Goal | Mode the skill recommends |
|---|---|
| VPN replacement only (private apps) | Include |
| Internet security (SWG) only | Exclude |
| VPN replacement plus SWG | Exclude |
| Coexisting with another VPN | Include |
| DNS filtering only | DNS-only mode |
It adds that include and exclude are set per profile, that entries must match tunnel routes in both directions, and that MDM files override dashboard settings. Cloudflare's split tunnels docs have the details.
5. Output defaults and validation. Designs come back with assumptions, target architecture, rollout phases and open decisions. Troubleshooting comes back as traffic path, likely failure point, evidence to collect and next test. Validation prompts list what to test per area, such as authorized, unauthorized and posture-failing flows for Access. Under API safety: "Never guess category IDs, application IDs, wirefilter fields, or API request bodies," and "Do not enable broad production policies without explicit approval."
How do you install it?
Cloudflare's README lists several routes. Pick one per agent.
Just this skill, with the skills CLI. This is the command on skills.sh:
npx skills add https://github.com/cloudflare/skills --skill cloudflare-one
Add -g to install it for all projects. In Claude Code the folder lands in .claude/skills/cloudflare-one/ in your project, or under ~/.claude/skills/ globally, the standard Claude Code skill locations.
Claude Code plugin (every Cloudflare skill plus the MCP server). From the README:
/plugin marketplace add cloudflare/skills
/plugin install cloudflare@cloudflare
The skill leans on retrieval and on inspecting account resources, so the bundled Cloudflare MCP server is useful here. The plugin also brings cloudflare-one-migrations and gateway-workers, which this skill hands off to.
Codex plugin.
codex plugin marketplace add cloudflare/skills
codex plugin add cloudflare@cloudflare
Start a new Codex session afterward, as the README says.
Cursor, VS Code and manual copy. Cursor installs from its marketplace or as a remote rule pointing at cloudflare/skills. VS Code with GitHub Copilot installs from source after you enable chat.plugins.enabled. You can also clone the repo and copy the folder. See Codex skills and Cursor skills for agent-specific details.
How do you use it?
Say whether you want a design, a configuration change, a diagnosis or a review, and give the context the skill would ask for. Example prompts (suggestions, not quotes from the repo):
Design a VPN replacement for 300 remote staff reaching three internal apps. We use Okta with SCIM.Put our internal admin dashboard behind Access so only the ops group can reach it.Users can't reach 10.20.0.0/16 through WARP even though the tunnel is healthy. Walk me through what to check.Review our Gateway HTTP policies before we turn on TLS inspection for everyone.Plan a DLP rollout for credit card numbers that starts with logging, not blocking.
Expect questions before answers. The skill tells the agent to ask only the assessment prompts relevant to your task, then propose changes staged "disabled or scoped to a pilot group/site" for anything risky. You need a Cloudflare One account for real changes, and the agent needs docs access to be useful.
Tips and limits
- It is for operators, not app code. This skill is about identity, network and security policy. For Workers that run inside Gateway HTTP policies, it points to the separate
gateway-workersskill. - Migrations go elsewhere. Planning a move from another vendor is the job of
cloudflare-one-migrations, per the skill's own description. - Some products need Enterprise. The skill notes Cloudflare WAN "is gated behind Enterprise subscriptions." Check your plan before you design around it.
- It reflects current product names. It uses Cloudflare Mesh, noting it was "formerly WARP Connector," and the Cloudflare One Client naming. Older tutorials may use other names.
- No scripts. The folder is one Markdown file. Any change to your account goes through tools you give the agent.
- Audits. On 24 October 2026, skills.sh showed Pass from Gen Agent Trust Hub, Socket and Snyk.
- License. Apache-2.0 lets you copy and change it; keep the license and notices when you redistribute.
Save it in your Kipt library
In Kipt, open Skills and paste the skill's GitHub folder link into the import box. For a repo with many skills, like this one, Kipt shows a list, so you can take cloudflare-one-migrations and gateway-workers in the same pass. You can also drop the folder or a .zip. Your skills live in your own private GitHub repo and install into Claude Code or Codex with one command:
npx skills add https://github.com/<you>/<repo>.git --all -g
Kipt is not affiliated with Cloudflare.
Similar skills
- Cloudflare skill: the product chooser that sends Access and Zero Trust tasks to this skill.
- Terraform skill: for managing the resulting configuration as code.
- Security hardening skill: application-level security, the layer above network access.
- Wrangler skill: for the Workers side of a Cloudflare account.